Is Personally Identifiable Information safe in the hands of the State?

Tamil households were identified and attacked using electoral-registry information during the July 1983 pogrom, it was stated recently. Electoral-registry information includes a massive amount of Personally Identifiable Information (PII), such as name, physical address, and identity card number that can yield birthdate and gender. It is intended for the conduct of elections (with the thousands of Government officials operating polling centres as the primary users), but many others have access to copies.

Around 14,000 Grama Niladharis (GN) compile and certify data on electors within their areas. They possess the PII but this is not optimal for election canvassing or for identifying minority households to attack, because the GN divisions are small. Candidates can obtain copies for the entire electoral district by applying through the secretary of the party and paying the relevant fees. Given the proximity of the nationwide referendum conducted in December 1982 to July 1983, these were the copies likely to have been used in the attacks. 

Critics of digitalisation of public services, and especially of the Sri Lanka Unique Identity (SLUDI), point to the misuse of electoral registry information in 1983 as requiring extreme caution, if not the halting of these initiatives. Given the scale of the atrocity and the price paid by the victims, caution is essential. But it is important that we identify the real problem and the relevant trade-offs before hitting the brakes on digitalisation and SLUDI.

What has digitalisation got to do with it?

Computers were around in 1983 but were not integrated into operations of the Department of Elections. Candidates paid for the copies of the voter registries by the page; they still do. The crimes of July 1983 were committed using photocopies. Even today, it is doubtful that the Elections Commission is capable of providing district-wide information in digital form.

The real problem is that the State has an extraordinary amount of PII and related information about those under its authority. James Scott in his book “Seeing Like a State: How Certain Schemes to Improve the Human Condition Have Failed” makes a powerful argument against the proclivity of the State in its high-modernist phase to make people “administratively legible.” To effectively manage masses of people, the State makes them “legible” by standardising their names, addresses, identities, etc., and thereby collects and processes more and more information about people (PII for the most part). Its purpose is control, broadly defined. 

Control can be good or bad. If the means of control are effective, there is always the potential for abuse by bad actors within or outside the State. If the voter information came from the Grama Niladharis or from within the Department of Election in July 1983, it would have been insiders who abused the system. If it came from those who had obtained information for the 1982 campaigns, it would have been outsiders. There is no evidence that the political authorities or the then Commissioner of Elections, Chandrananda de Silva, ordered or allowed the release of the information. The use of Government files and records to identify and persecute minorities as was done by the Nazi Government in Germany appears unlikely.  

Digitalisation had nothing to do with it.

Can we not digitalise?

Scott makes a strong argument against control by the State by making citizens legible and collecting and processing information about them. But he fails to address the trade-offs. By not maintaining electoral registries containing PII it would be possible to avoid the recurrence of the despicable acts of 1983. But would it be possible to conduct free and fair elections without PII? Is there a middle ground that minimises the dangers of allowing the targeting of classes of citizens in their homes, while enabling free and fair elections?

It may be argued that the frictions inherent in pre-digital technologies of information collection and processing are reduced by digitalisation. A few keystrokes can transmit a copy of a document, without the trouble of photocopying, mailing, etc. The dangers caused by lower friction underly the safeguards embedded in data protection laws like the enacted, amended and not-yet-activated 

Personal Data Protection Act, No. 9 of 2022

Digitalisation did not contribute to the abuses of PII in 1983. But will digitalisation not amplify the risks? Yes, it may, unless the proper design safeguards are built into the digitalised systems and are backed up by the appropriate administrative and legal changes, also described as analogue complements. Similarly, implementation of the proper digital elements and their analogue complements may reduce the risks of abuse.

The bottom line is that the conduct of elections involves control. A good voting mechanism must ensure:

• Correctness of the results
• Only eligible users vote;
• They only vote once;
• All votes counted are valid votes, and all valid votes are counted.
• Verifiability of results by involved parties
• Secrecy of votes

Current electoral systems and practices use enormous amounts of information (more than were used in the 1980s, for example the mandatory collection and verification of National Identity Card information) to achieve the above objectives. This is independent of digitalisation or the use of biometric-based identity authentication (SLUDI). 

Can digitalisation make things better?

The first step in digitalization is the reengineering of the work process to be digitalised. The lethal data elements in the 1983 case were names (indicates ethnicity) and physical addresses (allows the attack). Are they essential? And, if so, can access be limited?

Names and addresses are essential to ensure conditions 1(a-c) above under the current system. They are PII but do not fall under the category of sensitive PII (e.g., health information, NIC number). The Grama Niladharis must certify that the electors live within the electoral district. Candidates wishing to communicate with the electors will demand addresses either to mail their propaganda or for door-to-door canvassing. Unless there is a radical change in the way candidates interact with electors, name and address information cannot be withheld from them.

If SLDUI is fully deployed, it would be possible to not share the name and address information with those running the polling centres and the agents of the candidates stationed therein and dispense with the polling cards too. The elector gets an electronic message saying he/she is entitled to vote at any polling station within the district (or anywhere, if the law permits); goes to a polling station and provides biometrics. If approved, the voting slip is generated, and the vote can be cast. 

The need for house-to-house canvassing will have to be rethought, with input from parties and candidates. Given the limits placed on election expenditures, this old form of collecting votes may in any case be impractical. In the same way that ride-hailing services allow driver-ride hailer communication without disclosing telephone numbers, it may be possible to allow candidates to send a limited number of electronic messages to electors without the numbers being disclosed and thereby also prevent spamming. This would be a radical change in campaigning, but one that has many benefits, including reduced paper use and annoyance. 

Necessary trade-offs

If the 14,000 Grama Niladharis are unable to know who the residents of their GN divisions are and where they live, it will be impossible to deliver a whole range of public services. Preventing the leakage of name-address information cannot come at the cost of the State’s ability to deliver services. 

Changing how election campaigns are conducted and voting is managed can have many benefits, including but not limited to restricting access to sensitive PII by political actors. But the State must be able to know where its “customers” (those availing of public services) reside. It cannot function if Grama Niladharis, the foot soldiers of the State, cannot be trusted within technical and administrative guard rails. For example, if the databases reside in the Government cloud, it is advisable to log all actions such as access and copying (not routine with paper and file-based systems). 

Digitalisation will not necessarily make things worse as claimed by those with incomplete understandings of Jeremy Bentham’s never fully realised panopticon idea. Digitalisation may, with intelligent design and analogue complements, make things better than they are now. Striving for those incremental changes is more productive (and challenging) than jeremiads of digital dystopias.